<!DOCTYPE html>
<html lang="en" class="auto-color">
<head>
<title>Hunting for Malicious Binaries and Backdoors in the Running Containers</title>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="HandheldFriendly" content="True" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<style>
        :root {
            --button-bg-color: #f3f2f2;
            --button-text-color: var(--color-darkgrey);
        }
    </style>
<link rel="stylesheet" type="text/css" href="/assets/built/screen.css?v=edaa6c6f91" />
<meta name="description" content="An attacker might exploit one of the container&#x27;s service and install malicious apps or a backdoor to get access to your container later. In this post, you&#x27;ll learn how to use the &quot;docker diff&quot; plugin to do forensics and incident response on a running docker container." />
<link rel="canonical" href="https://tbhaxor.com/hunting-malicious-binaries-in-containers/" />
<meta name="referrer" content="no-referrer-when-downgrade" />
<link rel="amphtml" href="https://tbhaxor.com/hunting-malicious-binaries-in-containers/amp/" />
<meta property="og:site_name" content="tbhaxor" />
<meta property="og:type" content="article" />
<meta property="og:title" content="Hunting for Malicious Binaries and Backdoors in the Running Containers" />
<meta property="og:description" content="An attacker might exploit one of the container&#x27;s service and install malicious apps or a backdoor to get access to your container later. In this post, you&#x27;ll learn how to use the &quot;docker diff&quot; plugin to do forensics and incident response on a running docker container." />
<meta property="og:url" content="https://tbhaxor.com/hunting-malicious-binaries-in-containers/" />
<meta property="og:image" content="https://tbhaxor.com/content/images/2022/03/malware.jpeg" />
<meta property="article:published_time" content="2022-04-01T08:30:00.000Z" />
<meta property="article:modified_time" content="2022-04-01T08:30:00.000Z" />
<meta property="article:tag" content="docker" />
<meta property="article:tag" content="containers" />
<meta property="article:tag" content="blue-team" />
<meta property="article:tag" content="forensics" />
<meta name="twitter:card" content="summary_large_image" />
<meta name="twitter:title" content="Hunting for Malicious Binaries and Backdoors in the Running Containers" />
<meta name="twitter:description" content="An attacker might exploit one of the container&#x27;s service and install malicious apps or a backdoor to get access to your container later. In this post, you&#x27;ll learn how to use the &quot;docker diff&quot; plugin to do forensics and incident response on a running docker container." />
<meta name="twitter:url" content="https://tbhaxor.com/hunting-malicious-binaries-in-containers/" />
<meta name="twitter:image" content="https://tbhaxor.com/content/images/2022/03/malware.jpeg" />
<meta name="twitter:label1" content="Written by" />
<meta name="twitter:data1" content="Gurkirat Singh" />
<meta name="twitter:label2" content="Filed under" />
<meta name="twitter:data2" content="docker, containers, blue-team, forensics" />
<meta name="twitter:site" content="@tbhaxor" />
<meta name="twitter:creator" content="@tbhaxor" />
<meta property="og:image:width" content="769" />
<meta property="og:image:height" content="330" />
<script type="application/ld+json">
{
    "@context": "https://schema.org",
    "@type": "Article",
    "publisher": {
        "@type": "Organization",
        "name": "tbhaxor",
        "url": "https://tbhaxor.com/",
        "logo": {
            "@type": "ImageObject",
            "url": "https://tbhaxor.com/favicon.ico",
            "width": 48,
            "height": 48
        }
    },
    "author": {
        "@type": "Person",
        "name": "Gurkirat Singh",
        "image": {
            "@type": "ImageObject",
            "url": "https://tbhaxor.com/content/images/2021/07/28386721.png",
            "width": 400,
            "height": 400
        },
        "url": "https://tbhaxor.com/author/tbhaxor/",
        "sameAs": [
            "https://tbhaxor.com",
            "https://twitter.com/tbhaxor"
        ]
    },
    "headline": "Hunting for Malicious Binaries and Backdoors in the Running Containers",
    "url": "https://tbhaxor.com/hunting-malicious-binaries-in-containers/",
    "datePublished": "2022-04-01T08:30:00.000Z",
    "dateModified": "2022-04-01T08:30:00.000Z",
    "image": {
        "@type": "ImageObject",
        "url": "https://tbhaxor.com/content/images/2022/03/malware.jpeg",
        "width": 769,
        "height": 330
    },
    "keywords": "docker, containers, blue-team, forensics",
    "description": "An attacker might exploit one of the container&#x27;s service and install malicious apps or a backdoor to get access to your container later. In this post, you&#x27;ll learn how to use the &quot;docker diff&quot; plugin to do forensics and incident response on a running docker container.",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://tbhaxor.com/"
    }
}
    </script>
<meta name="generator" content="Ghost 4.42" />
<link rel="alternate" type="application/rss+xml" title="tbhaxor" href="https://tbhaxor.com/rss/" />
<script defer src="/public/cards.min.js?v=edaa6c6f91"></script>
<link rel="stylesheet" type="text/css" href="/public/cards.min.css?v=edaa6c6f91">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/PrismJS/prism-themes/themes/prism-vsc-dark-plus.css">
<link rel="stylesheet" href="https://unpkg.com/prismjs@1.27.0/plugins/diff-highlight/prism-diff-highlight.min.css">
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-57CDLG8');</script>
<style>
      figure.article-image, .gh-head-actions {
        display: none !important;
        visibility: hidden !important

      }

      .gh-head-menu { justify-content: center !important; }
      .gh-content p { text-align: justify !important }

      .gh-canvas {
      display: grid;
      grid-template-columns: [full-start] minmax(4vmin,auto) [wide-start] minmax(auto,240px) [main-start] min(950px,calc(100% - 8vw)) [main-end] minmax(auto,240px) [wide-end] minmax(4vmin,auto) [full-end];
  }

      ::selection {
      color: white;
      background: #4b4caa;
    }
     	code[class*="language-"] {
          font-size: 15px !important;
     	}

</style>

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.10.1/dist/katex.css" crossorigin="anonymous">
<script defer src="https://cdn.jsdelivr.net/npm/katex@0.10.1/dist/katex.js" crossorigin="anonymous"></script>
<script defer src="https://cdn.jsdelivr.net/npm/katex@0.10.1/dist/contrib/auto-render.min.js" crossorigin="anonymous" onload="renderMathInElement(document.body);"></script>

<script>
  var gh_search_key = '5568b1033f13ef38f045929e68';
  var gh_search_migration = 'v2';
</script><style>:root {--ghost-accent-color: #151719;}</style>
</head>
<body class="post-template tag-docker tag-containers tag-blue-team tag-forensics has-sans-body">
<div class="viewport">
<header id="gh-head" class="gh-head has-cover">
<nav class="gh-head-inner inner gh-container">
<div class="gh-head-brand">
<a class="gh-head-logo" href="https://tbhaxor.com">
tbhaxor
</a>
<a class="gh-burger" role="button">
<div class="gh-burger-box">
<div class="gh-burger-inner"></div>
</div>
</a>
</div>
<div class="gh-head-menu">
<ul class="nav">
<li class="nav-about-me"><a href="https://tbhaxor.com/about/">About Me</a></li>
<li class="nav-projects"><a href="https://tbhaxor.com/projects/">Projects</a></li>
<li class="nav-series"><a href="https://tbhaxor.com/series/">Series</a></li>
</ul>
</div>
<div class="gh-head-actions">
<div class="gh-social">
<a class="gh-social-twitter" href="https://twitter.com/tbhaxor" title="Twitter" target="_blank" rel="noopener"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M30.063 7.313c-.813 1.125-1.75 2.125-2.875 2.938v.75c0 1.563-.188 3.125-.688 4.625a15.088 15.088 0 0 1-2.063 4.438c-.875 1.438-2 2.688-3.25 3.813a15.015 15.015 0 0 1-4.625 2.563c-1.813.688-3.75 1-5.75 1-3.25 0-6.188-.875-8.875-2.625.438.063.875.125 1.375.125 2.688 0 5.063-.875 7.188-2.5-1.25 0-2.375-.375-3.375-1.125s-1.688-1.688-2.063-2.875c.438.063.813.125 1.125.125.5 0 1-.063 1.5-.25-1.313-.25-2.438-.938-3.313-1.938a5.673 5.673 0 0 1-1.313-3.688v-.063c.813.438 1.688.688 2.625.688a5.228 5.228 0 0 1-1.875-2c-.5-.875-.688-1.813-.688-2.75 0-1.063.25-2.063.75-2.938 1.438 1.75 3.188 3.188 5.25 4.25s4.313 1.688 6.688 1.813a5.579 5.579 0 0 1 1.5-5.438c1.125-1.125 2.5-1.688 4.125-1.688s3.063.625 4.188 1.813a11.48 11.48 0 0 0 3.688-1.375c-.438 1.375-1.313 2.438-2.563 3.188 1.125-.125 2.188-.438 3.313-.875z" /></svg>
</a>
</div>
<a class="gh-head-button" href="#/portal/signup" data-portal="signup">Subscribe</a>
</div>
</nav>
</header>
<div class="site-content">
<main id="site-main" class="site-main">
<article class="article post tag-docker tag-containers tag-blue-team tag-forensics image-small">
<header class="article-header gh-canvas">
<section class="article-tag">
<a href="https://tbhaxor.com/tag/docker/">docker</a>
</section>
<h1 class="article-title">Hunting for Malicious Binaries and Backdoors in the Running Containers</h1>
<p class="article-excerpt">An attacker might exploit one of the container&#x27;s service and install malicious apps or a backdoor to get access to your container later. In this post, you&#x27;ll learn how to use the &quot;docker diff&quot; plugin to do forensics and incident response on a running docker container.</p>
<div class="article-byline">
<section class="article-byline-content">
<ul class="author-list">
<li class="author-list-item">
<a href="/author/tbhaxor/" class="author-avatar">
<img class="author-profile-image" src="/content/images/size/w100/2021/07/28386721.png" alt="Gurkirat Singh" />
</a>
</li>
</ul>
<div class="article-byline-meta">
<h4 class="author-name"><a href="/author/tbhaxor/">Gurkirat Singh</a></h4>
<div class="byline-meta-content">
<time class="byline-meta-date" datetime="2022-04-01">Apr 1, 2022</time>
<span class="byline-reading-time"><span class="bull">&bull;</span> 5 min read</span>
</div>
</div>
 </section>
</div>
<figure class="article-image">
<img srcset="/content/images/size/w300/2022/03/malware.jpeg 300w,
                            /content/images/size/w600/2022/03/malware.jpeg 600w,
                            /content/images/size/w1000/2022/03/malware.jpeg 1000w,
                            /content/images/size/w2000/2022/03/malware.jpeg 2000w" sizes="(min-width: 1400px) 1400px, 92vw" src="/content/images/size/w2000/2022/03/malware.jpeg" alt="Hunting for Malicious Binaries and Backdoors in the Running Containers" />
<figcaption>The image has been taken from <a href="https://containerjournal.com/topics/container-security/protecting-containers-against-doki-malware/">https://containerjournal.com/</a></figcaption>
</figure>
</header>
<section class="gh-content gh-canvas">
<p>Hello World! Let's say your containers are compromised and adversaries have left a backdoor on it or malware that could be a miner or anything. You got to know via system logs because of unusual activities and spikes in container usage and unfortunately, there is no further monitoring implemented via tools like ELK stack and Wazuh.</p><p>Now how would you confirm the breach, find the malware and kill it? Yeah, killing container and starting a new one from the legit image makes sense. But if you are from an infosec background, you won't do that, instead, find the malware in the container, kill it, and later dissect it to learn more about its behavior. </p><p>In this post, I will be discussing the following two labs with you that will cover the answers to the following questions.</p><ul><li><a href="#identifying-the-backdoor-user">Identifying the Backdoor User</a> (<strong><a href="https://attackdefense.com/challengedetails?cid=1454">Link to Lab</a></strong>)</li><li><a href="#hunting-for-malicious-binaries">Hunting for Malicious Binaries</a><strong> </strong>(<strong><a href="https://attackdefense.com/challengedetails?cid=1455">Link to Lab</a></strong>)</li></ul><h1 id="identifying-the-backdoor-user">Identifying the Backdoor User</h1><p>In this lab, you are on the host machine and got to know that an attacker has compromised your running WordPress container. You need to identify the changes made in the container. We have seen in the <strong><a href="https://tbhaxor.com/analyzing-docker-image-for-hunting-secrets/">Analyzing Docker Image for Retrieving Secrets</a> </strong>post the container-diff tool depends on the exported image file (tar archive), and the catch is you are supposed to do it in the running container. </p><p>As you can see the docker container is running without any checkpoint which means that this is the container that is compromised.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-30-at-11.50.43-PM.png" class="kg-image" alt loading="lazy" width="1988" height="258" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-30-at-11.50.43-PM.png 600w, https://tbhaxor.com/content/images/size/w1000/2022/03/Screenshot-2022-03-30-at-11.50.43-PM.png 1000w, https://tbhaxor.com/content/images/size/w1600/2022/03/Screenshot-2022-03-30-at-11.50.43-PM.png 1600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-30-at-11.50.43-PM.png 1988w" sizes="(min-width: 720px) 720px"><figcaption>Docker container <code>wordpress</code> is running with no checkpoints</figcaption></figure><p>The <a href="https://docs.docker.com/engine/reference/commandline/diff/"><strong><code>docker diff</code></strong></a> plugin is used to check the file changes made in the container since its creation. It comes with the docker client so you don't have to set it up. It gives you the mode of action and file name which means the following:</p><figure class="kg-card kg-code-card"><pre><code>A /path/to/file means that the file has been added
C /path/to/file means that the file has been modified
D /path/to/file means that the file has been deleted
</code></pre><figcaption>The different types of change are tracked</figcaption></figure><p>Now, if you want to get these changes, simply call <code>docker diff wordpress</code> command, it will give you a suspicious entry <strong>C /etc/shadow. </strong>Shadow file in Linux is the Database of the usernames and passwords and is very unlikely to be changed in the container.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-3.01.48-PM.png" class="kg-image" alt loading="lazy" width="762" height="304" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-3.01.48-PM.png 600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-3.01.48-PM.png 762w" sizes="(min-width: 720px) 720px"><figcaption>Checking for filesystem changes using <code>docker diff</code></figcaption></figure><blockquote><strong>Note:</strong> Changes made while creating images from Dockerfile instructions will not be tracked by the docker diff. For that you need to use container-diff analyze tool</blockquote><p>Copy the file from the container using <code>docker cp wordpress:/etc/shadow shadow.new</code> and start the container with the original image to save the shadow file from that container as <code>shadow.old</code> file.</p><p>To find the changes between this file, you can use the diff command which will give you the following output.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.07.21-AM.png" class="kg-image" alt loading="lazy" width="1638" height="392" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.07.21-AM.png 600w, https://tbhaxor.com/content/images/size/w1000/2022/03/Screenshot-2022-03-31-at-12.07.21-AM.png 1000w, https://tbhaxor.com/content/images/size/w1600/2022/03/Screenshot-2022-03-31-at-12.07.21-AM.png 1600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.07.21-AM.png 1638w" sizes="(min-width: 720px) 720px"><figcaption>Finding the backdoor user from the running container with docker CLI</figcaption></figure><p>Finally, we found that the attacker is using <code>service</code> account as a backdoor to login into the system.</p><h1 id="hunting-for-malicious-binaries">Hunting for Malicious Binaries</h1><p>This lab is more interesting as it requires some knowledge of GDB and Linux. Anyways, in this lab, the attacker has compromised a running WordPress docker container and added a backdoor. You have root access to the host machine. You are supposed to find the remote host backdoor is trying to reach.</p><p>As you can see the <code>wordpress</code> container is the only one that is running, therefore it is the one that is compromised.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.18.11-AM.png" class="kg-image" alt loading="lazy" width="1966" height="312" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.18.11-AM.png 600w, https://tbhaxor.com/content/images/size/w1000/2022/03/Screenshot-2022-03-31-at-12.18.11-AM.png 1000w, https://tbhaxor.com/content/images/size/w1600/2022/03/Screenshot-2022-03-31-at-12.18.11-AM.png 1600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.18.11-AM.png 1966w" sizes="(min-width: 720px) 720px"><figcaption>Checking for containers and images</figcaption></figure><p>Using the knowledge from the previous lab to find the suspicious files. In this, we <code>/tmp/do</code> and <code>/tmp/sample</code> are the two files added and <code>/run.sh</code> file is changed. If you would see the container, it is the entry point of the container.</p><p>The malware could be added here so that when the container is restarted, it gets started automatically.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.26.40-AM.png" class="kg-image" alt loading="lazy" width="698" height="312" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.26.40-AM.png 600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.26.40-AM.png 698w"><figcaption>Checking for filesystem changes using <code>docker diff</code></figcaption></figure><p>Well well! It is correct. As you can see there is a suspicious file at the last line and it is pointing to <code>/tmp/sample</code>. It is now confirmed that this is the entry point of the backdoor.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.29.54-AM.png" class="kg-image" alt loading="lazy" width="1442" height="642" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.29.54-AM.png 600w, https://tbhaxor.com/content/images/size/w1000/2022/03/Screenshot-2022-03-31-at-12.29.54-AM.png 1000w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.29.54-AM.png 1442w" sizes="(min-width: 720px) 720px"><figcaption>The backdoor is located at the <code>/tmp/sample</code></figcaption></figure><p>On checking the file magic number, you will find that the <code>/tmp/sample</code> is the only executable file available. Because of the missing Curl library, it is not executing.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.35.45-AM.png" class="kg-image" alt loading="lazy" width="1698" height="402" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.35.45-AM.png 600w, https://tbhaxor.com/content/images/size/w1000/2022/03/Screenshot-2022-03-31-at-12.35.45-AM.png 1000w, https://tbhaxor.com/content/images/size/w1600/2022/03/Screenshot-2022-03-31-at-12.35.45-AM.png 1600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.35.45-AM.png 1698w" sizes="(min-width: 720px) 720px"><figcaption>Confirming the malware but executing it</figcaption></figure><p>If you would recall the purpose of docker, is to share the packed application with others at no extra cost of resources. Therefore it does not have the curl library installed. In such cases, you can always copy files using <code><strong><a href="https://docs.docker.com/engine/reference/commandline/cp/">docker cp</a></strong></code> command as shown below.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.36.48-AM.png" class="kg-image" alt loading="lazy" width="842" height="92" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.36.48-AM.png 600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.36.48-AM.png 842w" sizes="(min-width: 720px) 720px"><figcaption>Copy the malicious file into the host file system</figcaption></figure><p>On running the program, it did not produce any output. To examine its working, here you need to have a basic understanding of gdb. Debug the code and you will find that there is a string compare function called.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.48.24-AM.png" class="kg-image" alt loading="lazy" width="932" height="172" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.48.24-AM.png 600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.48.24-AM.png 932w" sizes="(min-width: 720px) 720px"><figcaption>Found test condition that control curl execution</figcaption></figure><p>Add the breaking point at that location and run the code. You will see that the source string is <strong>2012-2-29</strong> and the destination string is <strong>2022-3-30. </strong>From this, we can understand that the current program is comparing the current system time with the one hardcoded in the source code.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.51.44-AM.png" class="kg-image" alt loading="lazy" width="1136" height="420" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.51.44-AM.png 600w, https://tbhaxor.com/content/images/size/w1000/2022/03/Screenshot-2022-03-31-at-12.51.44-AM.png 1000w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.51.44-AM.png 1136w" sizes="(min-width: 720px) 720px"><figcaption>Checking for required data in the</figcaption></figure><p>You can confirm this by disassembling the main function again and checking calls for <code>time</code> and <code>localtime</code> functions at the beginning of the program.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.56.33-AM.png" class="kg-image" alt loading="lazy" width="1040" height="248" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.56.33-AM.png 600w, https://tbhaxor.com/content/images/size/w1000/2022/03/Screenshot-2022-03-31-at-12.56.33-AM.png 1000w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.56.33-AM.png 1040w" sizes="(min-width: 720px) 720px"><figcaption>Calling <code>time</code> and <code>localtime</code> functions to get the current system time</figcaption></figure><p>Set the time of the system using <code>date</code> command to the date required to run the program. You can use <code>date +%y-%m-%d -s "20120229"</code> command for this with the root user.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.57.31-AM.png" class="kg-image" alt loading="lazy" width="750" height="184" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-12.57.31-AM.png 600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-12.57.31-AM.png 750w" sizes="(min-width: 720px) 720px"><figcaption>Setting system date to <code>2012-02-29</code></figcaption></figure><p>Run the sample binary again and now it will take some time to try to reach the remote server and then eventually fail to print the error message with the remote host.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-1.00.12-AM.png" class="kg-image" alt loading="lazy" width="856" height="152" srcset="https://tbhaxor.com/content/images/size/w600/2022/03/Screenshot-2022-03-31-at-1.00.12-AM.png 600w, https://tbhaxor.com/content/images/2022/03/Screenshot-2022-03-31-at-1.00.12-AM.png 856w" sizes="(min-width: 720px) 720px"><figcaption>Getting the hostname the backdoor is trying to reach</figcaption></figure><blockquote>Since the machine is not connected to the internet, it is unable to make the reach the DNS server.</blockquote><h1 id="resources">Resources</h1><ul><li><a href="https://www.cprogramming.com/gdb.html">https://www.cprogramming.com/gdb.html</a></li><li><a href="https://en.cppreference.com/w/c/chrono/time">https://en.cppreference.com/w/c/chrono/time</a></li><li><a href="https://en.cppreference.com/w/c/chrono/localtime">https://en.cppreference.com/w/c/chrono/localtime</a></li><li><a href="https://docs.docker.com/engine/reference/commandline/diff/">https://docs.docker.com/engine/reference/commandline/diff/</a></li><li><a href="https://docs.docker.com/engine/reference/commandline/cp/">https://docs.docker.com/engine/reference/commandline/cp/</a></li></ul>
</section>
</article>
</main>
<aside class="read-more-wrap">
<div class="read-more inner">
<article class="post-card post ">
<a class="post-card-image-link" href="/corrupting-source-docker-image/">
<img class="post-card-image" srcset="https://images.unsplash.com/photo-1540476234148-4375fa8b8d6b?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8c2VhcmNofDV8fGNvcnJ1cHR8ZW58MHx8fHwxNjQ5NjQ2NjUx&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 300w,
                    https://images.unsplash.com/photo-1540476234148-4375fa8b8d6b?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8c2VhcmNofDV8fGNvcnJ1cHR8ZW58MHx8fHwxNjQ5NjQ2NjUx&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 600w,
                    https://images.unsplash.com/photo-1540476234148-4375fa8b8d6b?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8c2VhcmNofDV8fGNvcnJ1cHR8ZW58MHx8fHwxNjQ5NjQ2NjUx&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 1000w,
                    https://images.unsplash.com/photo-1540476234148-4375fa8b8d6b?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8c2VhcmNofDV8fGNvcnJ1cHR8ZW58MHx8fHwxNjQ5NjQ2NjUx&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 2000w" sizes="(max-width: 1000px) 400px, 800px" src="https://images.unsplash.com/photo-1540476234148-4375fa8b8d6b?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8c2VhcmNofDV8fGNvcnJ1cHR8ZW58MHx8fHwxNjQ5NjQ2NjUx&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000" alt="Corrupting the Source Docker Image" loading="lazy" />
</a>
<div class="post-card-content">
<a class="post-card-content-link" href="/corrupting-source-docker-image/">
<header class="post-card-header">
<h2 class="post-card-title">Corrupting the Source Docker Image</h2>
</header>
<div class="post-card-excerpt">
<p>In this post, we'll look at a few circumstances in which backdooring images could allow us to access a remote container.</p>
</div>
</a>
<footer class="post-card-meta">
<ul class="author-list">
<li class="author-list-item">
<a href="/author/tbhaxor/" class="static-avatar">
<img class="author-profile-image" src="/content/images/size/w100/2021/07/28386721.png" alt="Gurkirat Singh" loading="lazy" />
</a>
</li>
</ul>
<div class="post-card-byline-content">
<span class="post-card-byline-author"><a href="/author/tbhaxor/">Gurkirat Singh</a></span>
<span class="post-card-byline-date"><time datetime="2022-04-15">Apr 15, 2022</time> <span class="bull">&bull;</span> 7 min read</span>
</div>
</footer>
</div>
</article>
<article class="post-card post ">
<a class="post-card-image-link" href="/createremotethread-process-injection/">
<img class="post-card-image" srcset="https://images.unsplash.com/photo-1648977526715-0d99e6b21036?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDUzfHx8fHx8Mnx8MTY0OTA0MzIzOA&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 300w,
                    https://images.unsplash.com/photo-1648977526715-0d99e6b21036?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDUzfHx8fHx8Mnx8MTY0OTA0MzIzOA&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 600w,
                    https://images.unsplash.com/photo-1648977526715-0d99e6b21036?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDUzfHx8fHx8Mnx8MTY0OTA0MzIzOA&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 1000w,
                    https://images.unsplash.com/photo-1648977526715-0d99e6b21036?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDUzfHx8fHx8Mnx8MTY0OTA0MzIzOA&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 2000w" sizes="(max-width: 1000px) 400px, 800px" src="https://images.unsplash.com/photo-1648977526715-0d99e6b21036?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDUzfHx8fHx8Mnx8MTY0OTA0MzIzOA&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000" alt="Process Injection using CreateRemoteThread API" loading="lazy" />
</a>
<div class="post-card-content">
<a class="post-card-content-link" href="/createremotethread-process-injection/">
<header class="post-card-header">
<h2 class="post-card-title">Process Injection using CreateRemoteThread API</h2>
</header>
<div class="post-card-excerpt">
<p>CreateRemoteThread is the oldest method of process injection, and it is easily detectable. However, this establishes the foundations for process injection and code execution. This blog post will provide you with a thorough and practical explanation of how it works.</p>
</div>
</a>
<footer class="post-card-meta">
<ul class="author-list">
<li class="author-list-item">
<a href="/author/tbhaxor/" class="static-avatar">
<img class="author-profile-image" src="/content/images/size/w100/2021/07/28386721.png" alt="Gurkirat Singh" loading="lazy" />
</a>
</li>
</ul>
<div class="post-card-byline-content">
<span class="post-card-byline-author"><a href="/author/tbhaxor/">Gurkirat Singh</a></span>
<span class="post-card-byline-date"><time datetime="2022-04-11">Apr 11, 2022</time> <span class="bull">&bull;</span> 11 min read</span>
</div>
</footer>
</div>
</article>
<article class="post-card post ">
<a class="post-card-image-link" href="/interacting-protected-docker-registry/">
<img class="post-card-image" srcset="https://images.unsplash.com/photo-1649198667400-5238ba7e194c?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDEwfHx8fHx8Mnx8MTY0OTI0NTc2NQ&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 300w,
                    https://images.unsplash.com/photo-1649198667400-5238ba7e194c?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDEwfHx8fHx8Mnx8MTY0OTI0NTc2NQ&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 600w,
                    https://images.unsplash.com/photo-1649198667400-5238ba7e194c?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDEwfHx8fHx8Mnx8MTY0OTI0NTc2NQ&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 1000w,
                    https://images.unsplash.com/photo-1649198667400-5238ba7e194c?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDEwfHx8fHx8Mnx8MTY0OTI0NTc2NQ&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000 2000w" sizes="(max-width: 1000px) 400px, 800px" src="https://images.unsplash.com/photo-1649198667400-5238ba7e194c?crop&#x3D;entropy&amp;cs&#x3D;tinysrgb&amp;fit&#x3D;max&amp;fm&#x3D;jpg&amp;ixid&#x3D;MnwxMTc3M3wwfDF8YWxsfDEwfHx8fHx8Mnx8MTY0OTI0NTc2NQ&amp;ixlib&#x3D;rb-1.2.1&amp;q&#x3D;80&amp;w&#x3D;2000" alt="Interacting with Protected Docker Registry" loading="lazy" />
</a>
<div class="post-card-content">
<a class="post-card-content-link" href="/interacting-protected-docker-registry/">
<header class="post-card-header">
<h2 class="post-card-title">Interacting with Protected Docker Registry</h2>
</header>
<div class="post-card-excerpt">
<p>In this post, you will learn how to interact with the HTTP Basic Auth protected docker registry and cracking password with the hydra tool.</p>
</div>
</a>
<footer class="post-card-meta">
<ul class="author-list">
<li class="author-list-item">
<a href="/author/tbhaxor/" class="static-avatar">
<img class="author-profile-image" src="/content/images/size/w100/2021/07/28386721.png" alt="Gurkirat Singh" loading="lazy" />
</a>
</li>
</ul>
<div class="post-card-byline-content">
<span class="post-card-byline-author"><a href="/author/tbhaxor/">Gurkirat Singh</a></span>
<span class="post-card-byline-date"><time datetime="2022-04-08">Apr 8, 2022</time> <span class="bull">&bull;</span> 2 min read</span>
</div>
</footer>
</div>
</article>
</div>
</aside>
</div>
<footer class="site-footer outer">
<div class="inner">
<section class="copyright"><a href="https://tbhaxor.com">tbhaxor</a> &copy; 2022</section>
<nav class="site-footer-nav">
</nav>
<div><a href="https://ghost.org/" target="_blank" rel="noopener">Powered by Ghost</a></div>
</div>
</footer>
</div>
<script src="https://code.jquery.com/jquery-3.5.1.min.js" integrity="sha256-9/aliU8dGd2tb6OSsuzixeV4y/faTqgFtohetphbbj0=" crossorigin="anonymous">
</script>
<script src="/assets/built/casper.js?v=edaa6c6f91"></script>
<script>
$(document).ready(function () {
    // Mobile Menu Trigger
    $('.gh-burger').click(function () {
        $('body').toggleClass('gh-head-open');
    });
    // FitVids - Makes video embeds responsive
    $(".gh-content").fitVids();
});
</script>
<script src="https://cdn.jsdelivr.net/npm/prismjs@1.24.1/prism.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-clike.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-c.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-cpp.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-python.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-bash.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-markup-templating.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-php.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-sql.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-perl.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-diff.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-nginx.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-json.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-csharp.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-yaml.min.js"></script>
<script defer src="//unpkg.com/prismjs/components/prism-docker.min.js"></script>
<script defer src="//unpkg.com/prismjs/plugins/diff-highlight/prism-diff-highlight.min.js"></script>
<script defer src="//unpkg.com/prismjs/plugins/autoloader/prism-autoloader.min.js"></script>
<script>
    $(document).ready(function () {
		// add data-highlight class to the diff
        $("pre[class*='language-diff']").each(function() {
$(this).addClass("diff-highlight")
})

        
        // smooth scroll with anchor router
		$('a[href*="#"]:not([href="#"])').click(function() {
    		if (location.pathname.replace(/^\//, '') == this.pathname.replace(/^\//, '') && location.hostname == this.hostname) {
        		var target = $(this.hash);
        		target = target.length ? target : $('[name=' + this.hash.slice(1) + ']');
        		if (target.length) {
            		$('html, body').animate({
                		scrollTop: target.offset().top
            		}, 300);
            		return false;
        		}
    		}
		});
    })
</script>
</body>
</html>
